Telegram Desktop Bug Deletes 800 GB of User Data Due to Spelling Checker Path Error
A Windows user reported losing nearly 800 GB of data after updating Telegram Desktop. Files began disappearing from the custom directory C:\custom immediately after launching the messenger, while folders themselves remained intact.
Tracing the culprit
By monitoring application launches, the user isolated the issue to Telegram Desktop. Reinstalling the application to a separate location and creating test files confirmed that Telegram continued to target the original folder. Testing across versions showed the problem appeared after updating from 6.9.4 to 7.1.1.
Process Monitor investigation
Running Process Monitor revealed that Telegram.exe opened C:\custom, enumerated its contents, requested delete permissions, and attempted recursive removal. Stack traces pointed directly inside the Telegram binary, ruling out malware.
Root cause in spell checking
The deletion originated from the lib_spellcheck library. Telegram stores user-added words in a file named custom. In version 7.1.0, changes to support Windows native spell checking introduced a logic error: the path to the internal dictionary was set after an early return when the system spell checker was active.
With an empty working directory path, the code constructed the string /custom. Qt resolved this to C:\custom on the root of the current drive. The subsequent check if (QFileInfo(path).isDir()) { QDir(path).removeRecursively(); } then deleted the entire folder instead of a small internal dictionary directory.
Fix and impact
Developers corrected the issue in commit 9c316281 by setting the path before the return and added an empty-path guard in lib_spellcheck. The faulty versions remained available for roughly 66 hours. The bug was confirmed only on Windows with native spell checking enabled.
The case demonstrates how individually reasonable decisions—storing custom words, cleaning damaged directories, and using recursive deletion—combined into severe data loss when path validation was absent.
Related articles
Researcher Achieves SSTI-Based Defacement of First Partner Bank Web Service on Standoff 365
A security researcher known as grizzzer detailed a full attack chain that resulted in defacing the authorization page of the First Partner Bank digital banking service inside the Standoff 365 online polygon. The demonstration began with a successful DNS zone transfer against the fpb.stf domain, revealing the dbo.fpb.stf host that hosted the target application. After identifying the Node.js, Express, and React stack, the researcher discovered that the receipt generation endpoint accepted an undocumented pretty parameter that was passed directly into the Pug template engine. This led to a server-side template injection vulnerability that was escalated to a Node.js reverse shell. With code execution, the attacker located and modified the translation.json localization file, replacing the welcome message with the string pwned by VON visible to all users. The write-up concludes with concrete hardening recommendations including disabling zone transfers, avoiding direct spread of req.query into templates, and restricting outbound connections.
WatchGuard Issues Emergency Patches for Fireware OS Addressing 11 Vulnerabilities Including Pre-Auth RCE
WatchGuard Technologies released security updates for its Firebox firewall products on August 27, 2026, addressing 11 vulnerabilities in Fireware OS. Nine of the flaws affect the IKE daemon (iked) and can lead to buffer overflows, out-of-bounds reads, and double-free conditions when processing crafted IKE messages. Three CVEs (CVE-2026-19313, CVE-2026-19315, and CVE-2026-19318) may allow unauthenticated remote code execution due to memory corruption, with CVE-2026-19318 requiring the IKE payload diagnostic log to be enabled. An additional flaw, CVE-2026-13086, resides in the deprecated Mobile Security epm service and permits adjacent-network attackers with access to a trusted interface to execute arbitrary code as root without authentication. The company urges immediate application of Fireware versions 2026.2.2, 12.12.2, and 12.5.20.
CISA Adds CVE-2026-8452 to KEV Catalog and Orders Federal Agencies to Patch Citrix NetScaler by August 29 2026
CISA has placed CVE-2026-8452 in its Known Exploited Vulnerabilities catalog, compelling US federal agencies to apply patches to Citrix NetScaler before the unusually tight deadline of August 29 2026. The flaw, initially reported as a memory overflow leading to denial of service, has been confirmed through public technical analysis to enable unauthenticated remote code execution with root privileges on unpatched devices. The vulnerability impacts NetScaler ADC and NetScaler Gateway appliances configured as VPN Gateway or AAA virtual servers, with heightened risk in SAML-based deployments acting as either Service Provider or Identity Provider. Attackers have already conducted spray-and-pray campaigns that deploy webshells and perform basic reconnaissance after initial compromise. Tens of thousands of NetScaler instances remain internet-exposed, increasing the likelihood of automated mass exploitation. Citrix has released fixed builds including 14.1-72.61, 13.1-63.18, and 13.1-37.272 or higher for FIPS and NDcPP environments. Organizations are advised to inventory exposed devices, verify versions, hunt for indicators of compromise, and apply additional hardening measures beyond patching.
CISA Orders Federal Agencies to Patch Critical Citrix NetScaler RCE Flaw by August 29 2026
CISA has added CVE-2026-8452 to its Known Exploited Vulnerabilities catalog and set an unusually tight deadline for U.S. federal agencies to remediate the issue in Citrix NetScaler products. The vulnerability, initially described as a denial-of-service condition, is now actively exploited to achieve unauthenticated remote code execution with root privileges on unpatched appliances. Affected configurations include NetScaler ADC and NetScaler Gateway when deployed as VPN Gateway or AAA virtual servers, especially in environments using SAML for single sign-on. Attackers have been observed deploying webshells and performing reconnaissance after initial compromise in a spray-and-pray pattern. Tens of thousands of NetScaler devices remain exposed to the internet, increasing the risk of widespread automated attacks. Citrix has released fixed builds including 14.1-72.61 and 13.1-63.18, along with specific versions for FIPS and NDcPP environments.